Evidence capture rejects an absolute in-workspace symlink with '..' parts ("Unsafe evidence path"): a verified cell never gets a review #1157

Status 2026-10-26

• PR fix(review): normalise an absolute in-workspace symlink target before the '..' check (#1157) #1207 implements the proposed fix on main (normalise after relative_to, refuse a target that climbs out, unit and end-to-end tests) — benchflow
• Still on main 9c7a191 = PyPI 0.7.11 (review/evidence.py:219-230). On release/0.8, PR fix(review): record escaping workspace symlinks as evidence exclusions #1130's kept_link drops the same link as symlink_escape; it needs the same normalisation — benchflow
• FrontierPhysics-Infra keeps bench patch 43 (3111e65) until a release carries the fix — Bo

Problem. review.evidence._link_target does not normalise an absolute symlink target before its safety check. It strips the workspace prefix and passes the rest to _relative_path, which rejects any .. part. A link the agent made as /root/analysis/scripts/../figures resolves inside the workspace, yet the capture fails with EvidenceError: Unsafe evidence path: 'analysis/scripts/../figures'. Relative targets go through posixpath.normpath first, so only absolute ones are hit.

Evidence

• 2026-10-09 21:16 UTC run, Claude Haiku 5.5, glass-nonequilibrium-landscape-evolution trial 3 on Daytona. The verifier passed (reward 1.0), then the in-run review failed with the error above. The six review attempts and a post-hoc bench eval score failed the same way within four minutes. The sandbox was gone by then, so the stored export_error is re-raised on every later score, and the verified cell never gets a review.
• Traceback: review/evidence.py line 212 _relative_path(str(target)) in _link_target, line 198 raise EvidenceError(f"Unsafe evidence path: {value!r}").

Where (main e965eee, same as 0.7.8)

• src/benchflow/review/evidence.py:202-213 _link_target: the absolute branch checks target.relative_to(workspace) unnormalised. The relative branch (214-219) normalises.

Proposed fix

• Normalise the absolute target after relative_to(workspace) (posixpath.normpath). Raise "escapes workspace" when the result is .. or starts with ../. Otherwise check and return posixpath.relpath(normalized, parent).
• A test with an absolute in-workspace link containing .. (archived), and one that leaves after normalising (rejected).

Workaround in use: FrontierPhysics-Infra 3111e65 (bench patch 43) wraps _link_target this way for 0.7.8. The affected cell is re-run, because its workspace was never captured.